Galaxy Research analysts have tracked the movement of Bitcoin stolen in the third wave of attacks targeting Coldcard wallet users. The hacker has started laundering the funds through CoinJoin—a transaction method where multiple users’ transfers are bundled together, making it much harder to trace the coins on-chain.

What happened

The stolen assets are now moving through CoinJoin transactions. This approach is designed to break the link between inputs and outputs, making on-chain tracing way less transparent. Earlier, some of the Bitcoin had already been swapped to Ethereum using THORChain.

How CoinJoin works

CoinJoin mixes funds from several parties into a single batch of inputs and outputs. This makes it a headache for analysts to match senders and recipients, since individual amounts and addresses lose their direct connection inside the shared pool.

What else the hacker did

Besides CoinJoin, the attacker has already converted part of the stolen Bitcoin to Ethereum through THORChain. By combining asset swaps and transaction mixing, the hacker is making it a lot tougher to track the funds and piece together a full picture of where the money’s going.